CVE-2026-41274: Flowise: Cypher Injection in GraphCypherQAChain
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. This vulnerability is fixed in 3.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41274?
CVE-2026-41274 has been classified with a high severity due to the potential for Cypher injection attacks.
How do I fix CVE-2026-41274?
To fix CVE-2026-41274, upgrade Flowise to version 3.1.0 or later where the vulnerability has been addressed.
What types of attacks can CVE-2026-41274 facilitate?
CVE-2026-41274 can facilitate Cypher injection attacks, allowing an attacker to manipulate query execution.
Which versions of Flowise are affected by CVE-2026-41274?
CVE-2026-41274 affects versions of Flowise prior to 3.1.0.
Is user input safe in Flowise before patching CVE-2026-41274?
No, user input is not safe in Flowise before patching CVE-2026-41274 due to the lack of proper sanitization.